GitHub Webhook Secret Validation Mismatch? Fix Guide

const crypto = require('crypto');

app.post('/webhooks/github', express.raw({ type: 'application/json' }), (req, res) => {
  const sigHeader = req.headers['x-hub-signature-256'];
  if (!sigHeader) return res.status(400).send('Missing signature');

  // Strip the "sha256=" prefix GitHub prepends
  const receivedSig = sigHeader.replace(/^sha256=/, '');

  const expectedSig = crypto
    .createHmac('sha256', process.env.GITHUB_WEBHOOK_SECRET)
    .update(req.body)   // raw Buffer from express.raw()
    .digest('hex');

  const a = Buffer.from(receivedSig, 'hex');
  const b = Buffer.from(expectedSig, 'hex');
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).send('Signature mismatch');
  }

  const event = req.headers['x-github-event'];
  if (event === 'ping') return res.status(200).send('pong');

  const payload = JSON.parse(req.body);
  console.log('GitHub event:', event, 'repo:', payload.repository?.full_name);
  res.status(200).json({ received: true });
});